Forget about it: Data erasure rights a key feature of new draft privacy laws

“As more of our lives move online, these reforms will help strengthen privacy protections, boost accountability, and ensure Australians can embrace technology with greater confidence.”

The proposed new laws aim to tackle a raft of innovation challenges as well as combat cyber criminal activity. The recent controversies regarding the widespread adoption of cheap smartglasses capable of covertly recording others will come under the legislation, as will artificial intelligence, malicious activity such as scams and identity theft, and the impact caused by data breaches.

Four of the key aims of the new legislation will be to strengthen Australians’ privacy rights by requiring businesses to collect and use only information that is reasonably necessary and expected, give individuals the right to have personal data erased, introduce stronger consent standards, and prevent companies from buying and selling personal information such as shopping habits, online interests, and location data without clear permission.

“Getting Australia’s privacy settings right and building trust in our digital world is good for people and good for business,” Rowland said.

“We have opened public consultation to hear from regulated entities, experts and civil society about the design and implementation of these measures to protect Australians, while supporting innovation.”

Nicole Henry, head of government affairs, Australia and New Zealand, at cyber security firm Fortinet, called the government’s move a positive one.

VIEW ALL

“The consultation is an important opportunity to make sure those protections are practical, proportionate and supported by the technical capability needed to make them work,” Henry said.

“These proposals move Australia further away from relying on people to read privacy notices, provide consent and then manage the consequences themselves. It puts more responsibility back on organisations.

“One of the most important changes is the fair and reasonable test. Requiring organisations to ask whether it should be collecting, using or sharing information in the first place is where privacy and cyber security come together. They aren’t interchangeable; however, they work best together. Privacy sets the boundaries around how information should be used. Cyber security helps protect those boundaries and show that they are working.”

However, the proposed legislation could be a visibility challenge for cyber security teams.

“Organisations need to know what personal information they hold, where it is, how it moves, how it is protected, and fundamentally whether they still need it. AI makes this more difficult. Personal information can be combined, inferred and reproduced across training data, prompts, models and outputs. It can be more difficult to see how the information has been used, where it has gone and what meaningful erasure actually looks like,” Henry said.

“For the large digital platforms covered by the proposed right to erasure, policy and technical capability will need to line up. The right means very little if a platform cannot find the information, confirm the request is legitimate, apply the appropriate exceptions, remove the data securely and show what it has done.

“This difficulty also strengthens the case for data minimisation. Holding less unnecessary personal information means there is less for an attacker to steal, and potentially less harm if an intrusion succeeds.”

Individuals and organisations alike can have their say by visiting the Attorney-General’s Department consultation hub website. Submissions close on 18 September 2026.